论文标题
大鱼，小鱼，关键基础设施：对菲尼亚斯·费舍尔和对关键基础设施的“黑客主义”威胁的分析
Big Fish, Little Fish, Critical Infrastructure: An Analysis of Phineas Fisher and the 'Hacktivist' Threat to Critical Infrastructure
论文作者
论文摘要
许多风险决策文件中列出了黑客威胁行为者。然而，他们的战术和技术通常仍然是一个谜。我们创建了一个以Phineas Fisher的化名为众所周知的Hacktivist的Miter Att＆Ck（ATT＆CK）模型，并将其映射到关键基础设施的威胁。该分析来自黑客宣言，记者报告和官方政府文件。该分析填补了当前威胁模型的空白，以更好地定义确定的黑客可能采用的技能和方法。本文还确定了七个基本缓解，可以通过关键的基础设施运营和资产所有者部署，以防止黑客主义者的这种入侵。我们正在将这个威胁参与者贡献给ATT＆CK知识库。
The hacktivist threat actor is listed in many risk decision documents. Yet their tactics and techniques often remain a mystery. We create a MITRE ATT&CK (ATT&CK) model of a well known hacktivist who goes under the pseudonym of Phineas Fisher, and map that threat to critical infrastructure. The analysis is derived from hacker manifestos, journalist reporting, and official government documentation. This analysis fills a gap in current threat models, to better define what skills and methods a determined hacker might employ. This paper also identifies seven essential mitigations which can be deployed by critical infrastructure operations and asset owners, to prevent such intrusions by hacktivists. We are in the process of contributing this threat actor into the ATT&CK knowledge base.
